2023
Cyberstrategy Tool Kit
for Internal Buy-In
How to Win Budget and Influence Stakeholders
by Explaining Why Your Cybersecurity Strategy
Matters to Non-InfoSec Outsiders
in collaboration with

By the time you get to the end, this eBook will:

1

Offer your organization’s non-InfoSec staff
an easy-to-follow, contextualized summaryof major threat actors and their attack patterns
throughout 2022, pairing panicked headlines
end users see in the media with your strategic

Foreword
Welcome, stranger!

security recommendations.

2

Demonstrate exactly how those same proactive
security measures you’ve wanted to implement– and for everyone to use! – would haveThis eBook will vindicate you and your team’s

stopped devastating attacks in their tracks.

cyberdefense strategy for the next year, in a way thateveryone at your organization can understand, fundand follow.

3

Help you empower every stakeholder andend user to feel as though they helped
prevent major breaches and attacks, just byimplementing and committing to what you’vebeen asking them to do for years.

2023 Cyberstrategy Tool Kit for Internal Buy-In2

We want to help you keep your organization safe in2023 – but not through the same reactive, “patch
the headlines” approach that floods your inbox withpanicked requests every other month.

Show the “why” behind yourcyberdefense strategy – notjust the “what.”

Your team is burnt out, trying to follow that approach.
Your organization is burnt out!
Instead, use this eBook toolkit as your first step toshow the “why” behind your defense strategy – notjust the “what” – in a way that people outside of
InfoSec can understand. That way, you can lay theWe wish you the very best of luck, stranger. May thisplaybook help your team get the resources, manpower
and time they need to do what they do best: keeping
your organization safe throughout the next year
– and beyond.

groundwork for the investments needed to stop
cyberattacks before they happen.

Bring statistics to life through the true stories

Go beyond MITRE analysis and CVE criticality

Prove how a few months’ extra time andwe’ve curated here, of organizations just liketo show stakeholders how small investments

resources would give your team a chance toyours attacked by different cybercriminals

in “security extras” could have helped stop

test and roll out cross-organization patcheswith unique motivations and intrusion styles.

devastating real-world attacks, in a languageor remediations without interrupting regularand format people outside of the InfoSec

business operations… and before criminals

world can understand.

could target your systems.

2023 Cyberstrategy Tool Kit for Internal Buy-In

3

Contents
Foreword

2

The Defense Directory:
How to Arm Your Employees and Resource Your Team

5

Featured 2022 Threat Actors

24

ALPHV

26

APT29

30

Conti

34

Lapsus$38

InfoSec Tactical Index

42

MITRE Analysis

43

References and Sources

48

This document is provided strictly as a guide. No guarantees can be provided or expected. This document
contains the confidential information and/or proprietary property of Ivanti, Inc. and its affiliates (referred tocollectively as “Ivanti”) and may not be disclosed or copied without prior written consent of Ivanti.
Ivanti retains the right to make changes to this document or related product specifications and descriptions,at any time, without notice. Ivanti makes no warranty for the use of this document and assumes noresponsibility for any errors that can appear in the document, nor does it make a commitment to update theinformation contained herein. For the most current product information, please visit ivanti.com

2023 Cyberstrategy Tool Kit for Internal Buy-In

4

The Defense Directory:
How to Arm Your Employees
and Resource Your Team

Before we get to who we’ll be fighting off our networks forthe next twelve months, we really need to start with how
your organization should prepare their defense – and that
includes the tools and tactics you want to implement before

Each cyberdefense tactic will include:
Time to functionality and cost.

against certain types of cyberattacks.

a major breach occurs.
In fact, each of these chosen solutions could defend against
practically every threat actor we’ve selected for this Tool Kit,
in one way or another.

An explanation of how it helps defend

A simplified description of what the

An “Arm Your People!” cheatsheet todefense tool is.

overcome common objections frominternal stakeholders and move theOnce everyone has a clear understanding of the possible

conversation away from “Why do you

defense mechanisms that your team could deploy –need this?” to “How can we help pay

given time, leadership buy-in and resources – then we’ll

for and implement this?”show exactly where and how these techniques might
have stopped some of the most prevalent and nefarious
cyberattacks over the last few years.

2023 Cyberstrategy Tool Kit for Internal Buy-In

6

In This Section

The Defense Directory:
How to Arm Your Employees
and Resource Your TeamAnti-Phishing		

8

Antivirus / Antimalware		

9

Application Control		10

Configuration Management		

11

Device Hygiene & Management		

12

Endpoint Device & Response (EDR)		

13

Malicious Encryption Detection & Isolation		

14

Network Segmentation		

15

Passwordless Multi-factor Authentication (MFA)		

16

Privilege Management		

17

Risk-based Patch and Vulnerability Management		

18

Security Program Audits		

19

Strategic Automation		

20

User Access Control		21

User Training & Education		22Web-based Content Restrictions		

23

2023 Cyberstrategy Tool Kit for Internal Buy-In

7

Arm Your People! – Justifying to Stakeholders

Anti-Phishing“

Time to Functionality:
Days

Weeks

$$

Yes, there are free tools on some browsers and emails. However, they
aren’t available on all platforms, and incidents are increasing as employees$$$

increasingly use personal devices for professional purposes.

MonthsCost of Paid Tools (Entry to Robust Solutions)$Don’t we have a filter for spam messages?
Why should we get something different?

$$$$

$$$$$

“

Why is anti-phishing taking so long to implement after webought it?
List out every OS, device type, network system, browser and otherendpoint your anti-phishing solution must cover. This should be enough to

Description

illustrate why it’s not instantaneous!

“Anti-phishing” often refers to a suite of tools designed to stop
hackers from tricking users into clicking bad links or downloading
malicious files across multiple platforms, devices, browsers,
applications and text messages.

How It Helps Defend
Humans are not perfect! If a hacker manages to trick someone into
clicking a link or starting a file download, these tools help prevent any
malicious activity from actually occurring.

“

Why should we pay so much for these tools when there arefree versions?
The increased cost for more robust anti-phishing tools is usually due tomultiple platforms and devices. Credential hacking through phishing is acommon tactic of nearly threat actor, no matter their end motivation.
So, anti-phishing tools might ultimately be one of the simplest andcheapest ways to prevent expensive cybersecurity breaches!

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

8Arm Your People! – Justifying to Stakeholders

Antivirus / Antimalware“

Time to Functionality:
Days

Weeks

$$

You may be able to justify a switch to an improved antivirus or antimalware
solution if the free version is slowing down computers or generally causing

Months$$$operational issues.
If the operational impact becomes extreme enough, then you can argue

Cost of Paid Tools (Entry to Robust Solutions)$

Why should we spend more money on this when we havebuilt-in “free” vendor offerings?

that the free software isn’t worth the price. Your stakeholders will probably
$$$$

$$$$$

applaud your sourcing a new antivirus or malware tool.

Description
This is the most basic of any cybersecurity solutions, offering broadprotection and a general deterrent from basic penetration attempts.

How It Helps Defend
Essentially, antivirus and antimalware are the bare necessities anyorganization should implement – just to block and deter the mostbasic or opportunistic threats.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

9

Application Control

Arm Your People! – Justifying to Stakeholders“

Time to Functionality:
Days

Weeks

MonthsWhy should we pay for app control?
We already have these other user controls!
Of course, all control tools work together and layer one on another topresent the best possible cyberdefense.

Cost of Paid Tools (Entry to Robust Solutions)However, if you want to specifically budget for application control, you can
$

$$

$$$

$$$$

tell the non-InfoSec stakeholder that application control specifically could$$$$$

save the company money, by monitoring application usage and eliminating
unused “shelfware.”Description
Application control tools only allow certain applications within theprotected environment. These controls are typically found mostoften in highly regulated or enterprise-level organizations.

“If you do this, then I can’t run XYZ app that I need for my job!
This is another instance where proactive communication with all of yournon-InfoSec department stakeholders is key.

How It Helps Defend
By only permitting applications or software from an alreadyvetted “whitelist” of providers, application control prevents
unknown payloads hiding malware and Trojan viruses from being
accidentally downloaded by an employee – especially any without
signed certificates.

Get a comprehensive list of applications currently used by all departments– and discover the ones they’re paying for personally as “shadow IT” apps,
if you can. Then, as part of your whitelisting process, double-check every
app on that list won’t present a security threat, so that business operations
can continue without any significant interruption.
Then, make the process for requesting a new app to be added to protectedenvironment as painless and fast as possible, while still guaranteeing atleast one set of human eyes on each request. If you fully automate thisprocess, then hackers could possibly take advantage and secretly grant
permissions to their own activities.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

10

Arm Your People! – Justifying to Stakeholders

Configuration Management

configuration management tools. It can be a high-cost manual effort, too,
Weeks

MonthsCost of Paid Tools (Entry to Robust Solutions)$$$

Smaller organizations without high regulatory hurdles may find the costbenefit analysis tipped too far on the cost side to truly see a value forTime to Functionality:Days“

Why do we need to buy configuration management?

$$$so be sure to prove that the tool you want won’t become an administrative
burden on your team.
However, when done correctly, configuration management can help your

$$$$

$$$$$

organization save money by ensuring technology investments made acrossall departments are actually being installed.

Description
Settings, ports, protocols – all of these should be accounted for in
configuration management, to ensure the entire system has a securebaseline. Configuration management also includes ensuring all of theitems you’re paying for end up on the right devices and get used!

How It Helps Defend
Commonly open ports and configurations are publicly known by
threat actors. Sticking with defaults or no-longer-supported versions
create extended attack surfaces.
Configuration management can also support the overall security techstack by ensuring that other security programs aren’t forgotten or
aren’t set up properly on devices and environments.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

11Arm Your People! – Justifying to Stakeholders

Device Hygiene & Management
including Asset Discovery and Reconciliation“

We have ITAM – why do we need more?
A regular ITAM tool typically tracks just the devices and assets it expects
to find, from input purchase logs and active directories. Remind thisstakeholder that it’s what you don’t see or haven’t found yet that presents

Time to Functionality:Days

the biggest potential risk to impact regular business operations.
Weeks

Months

Between reconciling the active directory, procurement, endpoint
management and endpoint protection systems, you might still be missing

Cost of Paid Tools (Entry to Robust Solutions)20-30% of the assets your organization should be protecting – let alone
$

$$

$$$

$$$$

what devices any hackers or threat actors might introduce, or any malware$$$$$

payloads delivered from unaccounted for BYOD programs.

Description
For this Defense Directory, we’re defining Device Hygiene andManagement solutions as the tool or tool suite required to continuously
find, list, monitor and react to threats in every endpoint device, hardware
and software asset in your environment. For security purposes, solutions
should also facilitate or integrate with any direct remediations or actions“

Why pay for an upgrade?
As organizations increase in size, device counts rapidly expand beyond
cheaper option capabilities. And single project reconciliations degrade theinstant they’re done.

required in the event of an identified intruder.

Plus, consider that most free tools included with software suites rarely

How It Helps Defend

include dynamic asset discovery, which senses unknown or unaccounted

You can’t secure what you don’t know about. A cybersecurity solution
set requires a robust, dynamic and automatic accounting of every
endpoint in a protected network, as traditional device audits areaccurate only at the single point in time at which the discovery

for devices as they enter and exit the environment.
For security, asset discovery is a pivotal piece of the puzzle, not just a “niceto have,” when it comes to managing an attack surface.

project was finalized. Asset discovery capabilities support hygiene
and management programs by spotting unaccounted for devices forprotection... and possibly as a potential intruder pretending to be “justanother laptop” on the network.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

12

Arm Your People! – Justifying to Stakeholders

Endpoint Device & Response (EDR)
including Intrusion Detection System (IDS)& Intrusion Prevention System (IPS)“

Why pay for EDR when we have a free firewall?
Explain to a non-InfoSec user that it’s the difference between justhaving a wall, and having a wall plus gate-guards. The wall is a great
deterrent, but it doesn’t proactively scan for threats and try to stopthem from getting through.

Time to Functionality:

EDRs can be a lot of automatic security for a relatively low investment,
Days

Weeks

Cost of Paid Tools (Entry to Robust Solutions)
$

$$

$$$

in terms of both money and people.

Months

$$$$

$$$$$

“

Why is it taking so long to set up?
Remind your stakeholder that there’s a lot behind the scenes that requires
finetuning – stuff your team worries about so their teams won’t even know

Description

it’s there, when it’s done being implemented.

EDR solutions can identify and even stop unauthorized accessYour team will also need to monitor the initial installation over a longer

before it gets through. These are often paired with other initialaccess solutions, such as firewalls or antivirus / antimalware
protections. These tools can also be on a firewall, such as detecting

period of time to ensure that the EDR’s output can be trusted, which maylead to tweaks that cause some rough patches even after implementation.

unauthorized IP address origins. EDR solutions can be automated todetect access patterns and traffic trends that differ from baseline,
to alert to possible cyberattacks.

How It Helps Defend
You can only respond to the incidents you know about. The morealarms and traps you can set for hackers, the more attacks you’llknow about – and be able to stop.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

13

Arm Your People! – Justifying to Stakeholders

Malicious Encryption Detection& Isolation

“

Weeks

$$

but prepare for the worst.”

they reach this point, this software can act as an emergency brakewhen it detects encryption or exfiltration of sensitive data.

MonthsAnd how would the public react, if they knew you didn’t take every

Cost of Paid Tools (Entry to Robust Solutions)$Remind your non-InfoSec stakeholder of the adage, “Expect the best,

While your other security tools will hopefully stop cyberattacks before

Time to Functionality:Days

Why would we need to pay for this?

$$$possible, realistic opportunity to protect their information? Or your$$$$shareholders, to insulate their investment from theft of$$$$$

Description
When a bad actor begins to encrypt or exfiltrate files or data for
ransom or theft, this type of software can automatically detect
files under attack and isolate portions of the network or server toprevent further encryption.

intellectual property?

“

We have cyberinsurance, why bother going any further?
Cyberinsurance can help you pay for the damage control and clean up,
but it will still be astronomically cheaper and easier to deal with a media
statement about a stopped intrusion, rather than clean up after a fullblown breach.

How It Helps Defend
If all else fails, malicious encryption detection and isolation canhelp detect cybercriminals before they steal or lock enough data to
make it hurt.

Your insurance rates would also skyrocket, and probably require
additional – and perhaps even more expensive – safeguards to be put inplace, just to be able to be insurable.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

14

Arm Your People! – Justifying to Stakeholders

Network Segmentation“

between environments more intuitive.
Weeks

MonthsSo, remind your non-InfoSec stakeholder that with less time managing
or monitoring networks, you can get to the other items they’ve asked

Cost of Paid Tools (Entry to Robust Solutions)$$$

Network segmentation tools can save the security team time andresources, identifying network intruders and making authorized flow

Time to Functionality:Days

Why should we pay this much for a network segmentation tool?

$$$of your team.
$$$$

$$$$$

And, the more sophisticated a tool you get, the less of a hassle it’ll be
for their team to move from one network segment to another,

Description

when needed.

Network segmentation is the division of an organization’s internet
and intranet networks, so that only certain devices can accesscertain parts of applications or servers. It can be as simple asInternet of Things (IoT)-enabled devices on their own network
segment, to as complicated as each department and server with
its own environment and network.

“

Why is it so hard to get the documents I need out of this environment now?
Try to make the process for your non-InfoSec stakeholders to submitchange permission requests as simple and intuitive as possible.
Remind your team to be as patient as they can with any complaints –How It Helps Defend

especially at the start! You can minimize many of these complaints by

Network segmentation prevents hackers from being able to accessproactively including leads from all departments in the implementation

any other part of the network that their original compromised

process as project-consultants, telling you who needs access to whichcredentials or access point couldn’t access. If an attacker makes

segments and their general workflows.

it into a benign part of your environment – such as an IoT-enabled
toaster oven, for example – they don’t have greater access toanything sensitive.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

15

Arm Your People! – Justifying to Stakeholders

Passwordless Multi-factor
Authentication (MFA)“

Why does passwordless MFA cost so much more than alternatives?
There’s a range of passwordless MFA tools available. Generally speaking,the higher the per user cost, the higher the encryption levels and custom
controls available.

Time to Functionality:
Days

Better encryption helps keep hackers from breaking the system with sheer
Weeks

computer power.

MonthsAnd, custom controls can help decrease labor costs while making it more

Cost of Paid Tools (Entry to Robust Solutions)
$

$$

$$$

user friendly for everyone.
$$$$

$$$$$

Description
Passwordless MFA are login tools that require a secondary
authentication – via text / SMS, email, authenticator app requests,
or even biometric data – for access to applications or granting
permissions. Unlike traditional two-factor MFA, however, passwordless“

The time-out sessions are so annoying! Can you stop them?
First, depending on the relationship you have with the stakeholder, you
can joke around and say, “If you think they’re annoying, imagine how much
more frustrating it is for a hacker to constantly get kicked out! At least you
can get back in.”

MFA logins do not require a password.

Then – more seriously – you can show the non-InfoSec stakeholder thatHow It Helps Defend

some of the Defense Plays later in this eBook. The harder the organization

gaining access to the network is just the first part of a cyberattack, with

As a rule, the average non-InfoSec employee will avoid creatingcomplicated or unique passwords. By eliminating passwords, hackers

makes it for unauthorized hackers to stay in, the easier it will be for yourteam to detect the invasion and kick them out for good.

can’t access systems through credential stuffing, brute force
passwords, or an employee leaving their password out on a sticky note.
Plus, passwordless MFA programs can help increase compliance withsecurity programs, since it’s one less thing for them to remember!

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

16Arm Your People! – Justifying to Stakeholders

Privilege Management“

Time to Functionality:
Days

Weeks

$$

Yes, as a rule, it can take more labor to implement and maintain proper
privilege management programs, due to the need for constant supervision

Months$$$and user-level updates. This increased maintenance need is why it’s
generally used by enterprise-level organizations or those in highly
regulated industries.

Cost of Paid Tools (Entry to Robust Solutions)$

Why should we pay for this, too? It will take more man power todeploy and manage!

$$$$

$$$$$

So, if cost or internal support for this program is an issue with other nonInfoSec stakeholders, then consider tabling the discussion for this year.
Then, pay closer attention to initial permissions at onboarding, and avoid

Description

granting anyone admin access permissions as a rule.

Privilege management controls which types of employees needwhich permissions on their personal or network machines. For
example, the average office worker could probably use power
admin status on their personal machines, but generally do not needpermissions to install PowerShell.

If more (qualified) requests for exceptions to your rules begin to occur,then gather these requests as support for a more tech-based privilege
management solution. At some point, it will make economic sense to invest
in a tool that can automate at least part of the process for you.

How It Helps Defend
Similarly to access control, if a hacker accessed the average
employee’s desktop computer – for which that employee waslogged in as a super admin – they still wouldn’t be able to deploy
many hacking tools and gain greater network access, due to thelimited permissions.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

17

Arm Your People! – Justifying to Stakeholders

Risk-based Patch andVulnerability Management“

Weren’t we patching before? How is this different?
First, confirm that yes, your team was patching before, but remind yourstakeholder of the fire drills that happen all the time. Wouldn’t they like to
avoid the emergencies due to headlines? RBVM and RBVM can proactively
identify and patch the headlines that matter, respectively, before hackers

Time to Functionality:

come to you.
Days

Weeks

MonthsThen, explicitly reference the threat actor Defense Plays for those whohave attacked organizations like yours, to show point-by-point where

Cost of Paid Tools (Entry to Robust Solutions)patching exploited or older vulnerabilities could have stopped hacker
$

$$

$$$

$$$$

attacks early.

$$$$$

Finally, emphasize that you can’t do this sort of patching manually. Only

Description

RBPM and RBVM tools can automatically figure out which exploits matter

These tools identify and prioritize fixes based on an organization’s

to your unique threat environment – and determine if your devices and data

environment and needs – as well as roll out those patches! –are protected!

instead of patching based on external vulnerability ratings ofcriticality or vendor severity.

How It Helps Defend
RBPM and RBVM tools help organizations prioritize the patches
and security flaws that matter most for their devices and use case
– which includes emphasizing the weaknesses and vulnerabilities
that cybercriminals are using right now!

“

Why should we pay for this tool when there are free auto-patch software
versions out there?
Point out that risk-based vulnerability management tools can impact
multiple points of contact for threat actors throughout this book, so
investments in RBVM and RBPM tools – one to prioritize, and the other toroll out patches – can prevent multiple points of attack throughout a hack,even if you don’t know there’s a hacker in the system.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

18

Arm Your People! – Justifying to Stakeholders

Security Program Audits“

mission-critical systems or to known targets of threat actors – such as
Weeks

MonthsCost of Paid Tools (Entry to Robust Solutions)$$$Audits should be completed more often for high-risk environments,
partners and vendors. The more connected an environment is toTime to Functionality:
Days

Didn’t we just do an audit? Why pay for another one?

$$$a government agency or military contractor – the more likely it is that a
hacker is trying to access the environment.
Frequent audits may also catch a lurking hacker who is gathering

$$$$

$$$$$

information before the attack is properly launched. Early identification ofespecially savvy threat actors can save your organization millions in lost
data, reputation and legal expenses.

Description
Security Program Audits cover a wide range of services, but are
generally summarized as third-party consultants or analysts who
ensure cybersecurity solutions and programs are working; thatenvironments and roles are still copacetic; and can determine
if adjustments are needed. Penetration testing and employee
phishing training can fall in this category.

How It Helps Defend
Frankly, it’s very difficult for someone involved in any program or
project to see its flaws. In many cases, an external security audit
by a trusted provider is the only way you’re going to know if yoursecurity program is actually working the way you’ve designed.
Deep audits may also flush out oddities or dormant intrusions byeither internal threats or external hackers. An audit can also clean
up loose ends and random details that haven’t been reconciled orrealigned to their current roles.
2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

19

Arm Your People! – Justifying to Stakeholders

Strategic Automation“

specifically Alerts & Permission Requests

Why pay for automation tools?
Often, paying for more automated solutions is cheaper and more accurate
than hiring more security professionals... if you can even find a qualified
candidate for the role.

Time to Functionality:

Frequently, automation is a key feature of other security tools. It can be a
Days

Weeks

Monthsvalue-added benefit to justify selecting one tool or solution over another.

Cost of Paid Tools (Entry to Robust Solutions)
$

$$

$$$

$$$$

$$$$$

“

We tried automation before, and it broke everything.
Emphasize to nervous stakeholders that automation is not a replacement
for a human assessment, and will not be rolled out without thought, testing

Description

or care to disrupt business processes.

In this context, we’re discussing automated alerts of unwantedor unexpected activity, such as odd or out-of-place permission

To that end, when making your request, list out exactly what yourrequests. Automation can also help facilitate day-to-day activities

automation will and won’t do, to set expectations and calm nerves acrossfor general security programs.

the board.

How It Helps Defend
A single event log could go unnoticed by even the mostdetail-oriented security professional. However, that same event
could trigger an alert threshold to inform the correct remediationteam and automatically begin a seamless process of analysis
and remediation.

“

Why do we still submit tickets for access requests?
(“Can we automate <service>?”)While automation can help with some of the administrative overhead,hackers can and will take advantage of completely automated systems.
For example, hackers could trick a completely automated access request

As threats become more complex and as the responsibilities ofprocess to gain higher permissions and reach more of the network.

the InfoSec team expand, automation can help overtaxed andA human check can catch and stop that escalation.

impossible-to-hire-for security teams accomplish their missions
without sacrificing the safety of the company.
2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

20

Arm Your People! – Justifying to Stakeholders

User Access Control“

you’ll need to plan changes to the budget allocation every year, as well,Weeksdepending on how your organization plans to grow or consolidate.

MonthsTry reframing the ask in terms of an insurance per individual. Would theCost of Paid Tools (Entry to Robust Solutions)$$$

Generally speaking, user access control tools are a “pay per seat” model.
So, the bigger your organization gets, the more it will cost overall – andTime to Functionality:Days

Why does user access control cost so much?

$$$stakeholder be willing to pay $X per person, to avoid the risk of an average$$$$

employee accidentally leaving their laptop credentials out and laying bare$$$$$all of your intellectual property and customer records – even if they don’t
need access to that information?

Description
User access control tools help proactively manage which
employees and their job functions need access to which parts of
the network and applications for their jobs. These tools also help
retire access to previous permissions, as duties and roles changeover time.

“

I don’t have access to what I need anymore!
Try to make the process for your non-InfoSec stakeholders to submitchange permission requests as simple and intuitive as possible.
Remind your team to be as patient as they can with any complaints –especially at the start! You can minimize many of these complaints by

How It Helps Defend
Even if a hacker gained the credentials from an average employee,
user access controls only allow that hacker to access what that
employee could – not every possible file or data server. User

proactively including leads from all departments in the implementation
process as project-consultants, telling you who needs access to whichapplications and their general workflows.

access controls can also alert to unusual requests for access or
attempts to break in, offering early warnings of lateral movementfrom previously unsensed hackers.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

21

Arm Your People! – Justifying to Stakeholders

User Training & Education“

prevent, such as when they report a phishing attack.
Weeks

Months

You can also help enforce healthy security protocols by subsidizing
password managers.

Cost of Paid Tools (Entry to Robust Solutions)$$$

Incentivize the average non-InfoSec individual to use their training by
making a point to inform employees of attacks they, personally, helped

Time to Functionality:
Days

How can we implement training effectively?

$$$

$$$$

As a rule, try not to punish employees for non-compliance. Instead,$$$$$deliberately highlight and praise compliant behavior to make security ashared responsibility.

Description
Security training and education for the average non-InfoSec
employee can run from basic training modules, to involved tabletop
exercises and immersive simulations.

“

Why does user security training costs so much?
Effective user training is usually interactive with high-quality production– sometimes even custom scripts! These training modules are difficult to

How It Helps Defend

create, and so can be rather expensive.

Humans are the weakest link in any security chain. All the

However, the more interactive and relevant a user perceives their training

technology in the world cannot always prevent security accidents
triggered by the most well-meaning of individuals. Training
helps empower employees to take responsibility for their own
cybersecurity, strengthening their own understanding andto be, the greater participation and the better knowledge retention tends
to be – which means they can actually use their security education when it
matters the most.

hardening the overall organization’s security environment.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

22

Arm Your People! – Justifying to Stakeholders

Web-based Content Restrictions

restrictions of distracting or dangerous potential online content with actual,
Weeks

Months$$$$$work-related online needs – and the growing popularity of remote work.
These organizations often include government facilities, hospitals, call

Cost of Paid Tools (Entry to Robust Solutions)$Typically, this sort of tool is implemented in highly regulated, on-siteenvironments, due to the complexity of the implementation – balancing

Time to Functionality:Days“

Why should we buy a tool that restricts web content?

centers and even banks with their ATMs.
$$$$

$$$$$

However, if your organization wishes to move into highly regulated
verticals, such as finance, health or government, then more restrictive tools

Description

may be worth the investment.

These tools restrict what users can view or access online, whileworking from a protected work device.

You may also see a boost in productivity – though be careful how you pitch
this perk. Productivity will only be improved if employees can still accessthe content and resources they need to do their job, as well as distracting

How It Helps Defend
Threat actors and other hackers can route data and materialsites blocked during business hours.

through online applications. If you limit exposure to the internet,
then you’re limiting exposure to other threats – including possible
malware and outside network intrusions that could otherwise“hide” in web traffic.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

23

Featured 2022
Threat Actors
While there were quite a few cybersecurity incidents
throughout 2022, driven by a wide variety of different criminalgroups and motivations, we’ve selected four drasticallydifferent named threats to feature here.
Each of these groups will provide ample, relevant examples tohelp you push forward your strategic cybersecurity goals for2023 – no matter what you’re striving to accomplish.

In This Section
Featured 2022
Threat Actors

ALPHV		

26

APT29		

30

Conti		

34

Lapsus$		382023 Cyberstrategy Tool Kit for Internal Buy-In

25

What is RaaS, and why should your stakeholders care?

ALPHVRaaS is basically an organization that profits in part fromAs the creator of the original software, ALPHV charges

selling hacking software packages on the Dark Web ora percentage of any collected ransom fee without any

through various brokers.

additional dirty work. (That said, the gang can and doesWith a little strategic social engineering to get a footholdin a target’s computer system or network throughattack select targets directly, collecting 100% of theransom fee.)compromised credentials, RaaS locks up any critical files
The ALPHV group – also known as“BlackCat” and the latest public

unless the victim agrees to pay a ransom in exchange fora digital key.

iteration of BlackMatter and
DarkSide hacker gangs – is a primeexample of a cybercriminal gang
responsible for creating, sellingand deploying a “ransomware as aservice” model, or RaaS.

The difference with RaaS from ordinary ransomware is twofold:1

By packaging and selling the ransomware
software, ALPHV and other RaaS providers write

2

Nation-state threat actors such as Nobelium use“off the shelf” hacks such as BlackCat’s RaaS

code on behalf of other criminals who can’t (oras part their espionage or attacks on foreign

don’t want to) code – exponentially expanding thepowers, speeding up attacks and disguising theirrisk of potential cyberattacks within the landscape.

involvement by using others’ code while keeping

And, if hackers don’t need to know how to write

their own secret hacks for more valuable targets.

their own code to hack someone, then anyone with
bad intentions becomes a cyberthreat.

While the adoption and expansion of RaaS as a

Why? Because if many hackers use the same or

Dark Web “business model” continues to drive an

similarly sourced “off the shelf” exploits by using

incredible uptick in attacks at all sorts of organizations,the same or similar ransomware, then just a few

businesses and government agencies, it also presents

preventative measures can prevent a wide swath

an opportunity for savvy security teams.

of attacks.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

26

ALPHV Stat Sheet

Aliases:
BlackCat

Noburus

ALPHV

AlphaVM

ALPHA

Motive:Criminal / Financial

Threat Type:
Ransomware as a Service Gang

Affiliations and Associations:

Favorite Exploits:

Known Targeted Regions:

Russia

FIN12

CVE-2016-0099

CVE-2021-34473

Australia

Japan

Ryuk

FIN7

CVE-2019-7481

CVE-2021-34523

Austria

Middle East

Revil

Conti

CVE-2021-31207

EuropeSouth America

DEV-0504

BlackMatter

Germany

Switzerland

DEV-0237

DarkSide

India

USA

Italy

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

27

Organization Impact of Select
ALPHV Attacks“Terminals are operating with limited
capacity and have declared force majeure[an external, unavoidable and unforeseeable
event]. ”“It affects 233 fuel stations in northern
Germany. It is probably possible to pay
in cash.”January 29, 2022: Oiltanking + Mabanaft | Logistics | Germany“

The temporary outage
of its IT services[…] impacted theoperations of its
logistics centers andclient service activities.

“

December 23, 2021:
Moncler | Fashion / Retail | Milan“We assume that of the 3,000 IT
workstations affected, the first will beavailable again [four days after theattack.] […] Because one is dependent on
the IT systems, the administration is inemergency mode.”““““There is a possibility that customer
information […] was included in the[accessed] servers and PCs, and we are
currently identifying […] the existenceof leakage, scope of the damage, andinvestigating the cause.”“Asked if data was encrypted or copied by[ALPHV], a spokesperson said the firm will
not go beyond the statement.”
May 31, 2022: CMC Electronics | Military / Aerospace
Canada“July 3, 2022: Bandai Namco | Entertainment | Japan““We anticipate buildings to still be closed
Monday with no definite time frame ofreopening. […]“We do understand that we are very
vulnerable.”
August 17, 2022: Fremont County | Government | USA

Threat Actors

March 7-11, 2022: North Carolina A&T State University
Education | USA“

May 14, 2022: Carinthia | Government | Austria

Defense Directory“[The IT] staff there is literally working
around the clock to resolve this [attack]. I
really feel for the colleagues there who arejust putting in a Herculean lift to get us fullyback and functional.”

Tactical Index“As our systems have been inaccessible fordays, we are [working] hard to catch up withthe backlog that has arisen.”
July 22-23, 2022: Creos | Energy | Luxembourg

An ALPHV Cyberdefense Strategy:
How to Help Stop ALPHV Attacks Before a Ransom Request

Enter network
through compromised
credentials.

Map system
information andnetwork
freely or easily in the network,

Createvictim-specificransomware basedon unique “holes”
or exploits.

Stop security
programs fromblocking theransomware attack or
removal of data.

they can’t find important data

If cybercriminals can’t

Unusual behavior alerts can

Encrypt files and data
exfiltration (removal
or copying from thesystem) to create
leverage against
victim.

Stopping hackers before they

When intruders can’t moveenter the network is the easiest,
cheapest and fastest way toprotect every business unit

or vulnerabilities – mitigating

launch their ransomware,without disrupting operations.

major business impact.

signal the opening stages ofIf the hackers can’t steal orthen they can’t lock or steala ransomware attack before

lock data, then they have little

data for ransom.

business shutdown orleverage to demand a ransom.

ransom demands.

EDR
Restrict Web-based
Content
Antivirus / Malware

Risk-based Patch &Vulnerability Management

Risk-based Patch &Vulnerability Management

Device & Network
Segmentation

Application Control

Anti-Phishing on Mobile

Device Hygiene &Management

User Training & Education

Asset Reconciliation

Passwordless MFA

Secure Access Protocols

User Access Control

Network Segmentation

Application Control

Privilege Management

Device Hygiene &Management

Strategic Automation

Security Program Audits

User Access Control

Application Control
Strategic Automation
User Access Control

Malicious Encryption
Application
Control
Detection & Isolation
Strategic Automation
Device and Network
Segmentation
User
Access Control$$

Restricting Web-based
Content

Privilege Management
Device Hygiene &Management

Too late for proactive

Strategic Automation

prevention; shift to “disasterrecovery” mode.

Configuration Management

Strategic Automation
Configuration Management

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

29

Why should your stakeholders care about APT29 if you’re not a government agency?

APT29

As soon as non-InfoSec stakeholders hear that the

APT29 hackers didn’t target government agencies orlatest threat actor making headlines this week is part

critical infrastructure organizations directly. Instead,of Russian intelligence, they may want to dismiss thethey infected the software vendor-of-a-contractor, athreat altogether.

network monitoring software platform, to then install
backdoors on some 18,000 customers through a routine“Why would APT29 care about us?” they might say.

software update… which included government users.

“We’re not a government agency! We’re not part of a
The infamous hackers who leaked
the Democratic National Committee’sinternal emails and documents,

war effort!”

Not all 18,000 customers were targeted by APT29,
but all were hacked – and all were made vulnerable

Enter: the small world problem.

when they got caught up in an underground cyberwar

APT29, or “Nobelium,” is a cyber

Many social network research studies – from doctoral

organization connected to Russia’s

dissertations to Meta’s Facebook research to meme

foreign intelligence service dedicatedgames featuring actor Kevin Bacon – have examined

to espionage and intelligence activities.

connections between one relationship to the next in“APT” stands for “advanced persistent
threat.” This designation usuallydescribes a nation- or state-sponsoredother advanced persistent threat group because you’re

to be around three to four connections.

organization’s network and lurk for

push for a proactive cybersecurity strategy.

detection or attack.

push back against preparing against APT29 or any

from any starting point to the final “destination” seems

Now, let’s extend this hypothetical scenario to yourmonths – even years – before either

So, if any of your non-InfoSec stakeholders want topopulations of various sizes. The average “distance”

threat group which can penetrate an

between powerful nations.

“neutral” or a non-combatant, then play the 6 Degrees
of Separation game as a tabletop exercise orworkshop activity.
But this time, play through your organization’s
connections to Russia.

While your organization might not be a government
agency or an activist non-profit making trouble for
Russia, it’s not unheard of for threat actors to target
connections to their end goals – or connections-ofconnections-of-connections via supply chain attacks

Statistically speaking, your organization is– to affect crisis and extract information.

much closer to being an APT29 target – or target

For example, take the famous SolarWinds incident –stakeholders would like to believe.

for any other APT group – than non-InfoSec

an APT29 cyberattack from 2020.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

30

APT29 Stat Sheet
Aliases:
Nobelium

Cozy Bear

UNC-1151

YTTRIUM

CozyDuke

Cloaked Ursa

The Dukes

UAC-0113

Motive:Espionage / Covert Operations

Threat Type:
Advanced Persistent Threat / APT

Affiliations and Associations:
RussiaAPT28

ActiniumBlue Athena

Conti

Strontium

BromineSolarStorm

ALPHV

Iridium

KryptonTsar TeamFighting Ursa

DEV-0586

StellarParticle

Minidionis

Favorite Exploits:
CVE-2009-3129

CVE-2019-17026

CVE-2020-14882

CVE-2014-1761

CVE-2019-19781

CVE-2020-4006

CVE-2015-164

CVE-2019-2725

CVE-2020-5902

CVE-2018-13379

CVE-2019-7609

CVE-2021-1879

CVE-2019-11510

CVE-2019-9670

CVE-2021-21972

CVE-2019-1653

CVE-2020-0674

CVE-2021-26855

Critical At-risk Industries:
Government

Media and

Healthcare

Military

Telecommunications

Higher Education

EnergyNGOs and Non-profits

Financial

IT

Transportation

Research / Think Tanks

Known Targeted Regions:
Afghanistan

Chile

Iran

Lithuania

PolandSwitzerland

Armenia

China

Iraq

Luxembourg

Portugal

Tajikistan

Australia

Croatia

Ireland

Malaysia

Romania

Thailand

Azerbaijan

CyprusIsraelMexicoRussiaTurkeyBelarus

Czech

Japan

Mongolia

Slovakia

UAE

Belgium

FranceJordanMontenegro

Slovenia

UgandaBrazilGeorgia

Kazakhstan

Netherlands

South Africa

UK

Bulgaria

Germany

Kyrgyzstan

New ZealandSouth Korea

UkraineCanadaHungary

LatviaNorwaySpain

United States

Chechnya

India

Lebanon

Pakistan

SwedenUzbekistan

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

31Organization Impact of Select
APT29 Attacks““

Attack Started January 2020 – Announced February 16, 2022:
Cleared Defense Contractors | Military | USA

The phishing emails
sent by APT29
masqueraded asadministrative notices
related to various
embassies and utilized
legitimate but co-opted
email addresses.

“

Attack Started January 17, 2022 – Announced
April 28, 2022: Diplomatic Entities | Europe,Asia, North America“These actors [including APT29] takeadvantage of simple passwords, unpatchedsystems, and unsuspecting employees togain initial access before moving laterally
through the network to establish persistence
and exfiltrate data.”““Administrators found PCs locked anddisplaying a message demanding $10,000
in bitcoin, but the machines’ hard drives
were irreversibly corrupted when an admin
rebooted them.”“As early as May 2021, Russian statesponsored cyber actors took advantage ofa misconfigured account set to default MFA
protocols at a non-governmental organization(NGO), allowing them to enroll a new device
for MFA and access the victim network.”
Attack Started May 2021 – Announced March 15, 2022:
Non-government Organization | USA“

January 13, 2022: Government, Non-profit & IT
Organizations | Ukraine““Since early May, Cloaked Ursa [APT29]
has continued to evolve their abilities
to deliver malware using popular online
storage services[, including] DropBox and
Google Drive services.”“There is an increased potential for cyberattacks. These may have serious impact,even for countries and organisations notdirectly targeted [by cyber campaigns
conducted by Russia].”
February 18, 2022: “Nationally Significant Organizations”
New Zealand“

Attack Started May 2022 – Announced July 5, 2022:
Foreign Embassies | Portugal and Brazil““There has been a notable continuation of
the use of [publicly] available commodity
malware, showing UAC-0113 [APT29]
adapting its operations with a willingness touse a variety of tooling.”
Announced September 19, 2022: Government and Private
Sector | “Multiple Geographic Regions”

Defense Directory

Threat Actors

Tactical Index

An APT29 Cyberdefense Strategy:
How to Break APT29 Attacks Before Detection or Deletion

Enter network throughphishing campaigns
or via compromised
supply chain vendors.

Map network for
useful information
and weaknesses.

Stopping hackers before they

Access admin profiles
and / or intercept
authentication
packets to elevatehacked permissions.

move freely or easily in

Wait, exfiltrating
data and increasing
foothold against
defenses if discoveredin part by erasing logs.

enter the network is the easiest,

Limiting intruders’ ability to

the network, they can’t

Unusual behavior alerts cancheapest and fastest way toelevate credentials helps

protect every business unit

prevent data theft

without disrupting operations.

and extortion.

When intruders can’t

find important data or
vulnerabilities – mitigating
major business impact.

Attack on commandfor greatest confusion
and impact.

signal the opening stages ofa ransomware attack before
business shutdown or
ransom demands.

EDR

User Access Control

Restrict Web-based
Content

Privilege Management

Antivirus / Malware
Anti-PhishingUser Training & Education

Configuration Management

Risk-based Patch &Vulnerability Management
Device & Segmentation

Security Program Audits

Device Hygiene &Management

User Training & Education

Asset Reconciliation
Secure Access Protocols

Passwordless MFA

Security Program Audits

Application Control

EDR

Strategic Automation

Restricting Web-based
ContentToolate
for proactive
User
AccessControl
prevention; shift toStrategic Automation!

$$“disaster recovery” mode.

Malicious Encryption
Detection & Isolation

Network Segmentation

User Access Control

Privilege Management

Application Control

Strategic Automation

Device Hygiene &Management

Configuration Management

Security Program Audits
Strategic Automation
Configuration Management

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

33

With a lack of immediate news to pressure them

In fact, two full months after Conti shut down its

into action, non-InfoSec stakeholders may question

servers, the United States State Department released

your cybersecurity strategy if you bring up Contia new video highlighting its $10 million reward for

ransomware prevention – but you know that’s a red

information leading to the arrest of any “Conti” hackers.

herring distraction from the real threat.

Conti
For anyone in cybersecurity following
the latest ransomware news,“Conti” is a familiar name. Anotherthreat actor associated with – if notactively sponsored by – Russia, theransomware-as-a-service group madepublic headlines in February 2022 byannouncing its “full support of theRussian government” after its Ukrainian
invasion.

If Conti is gone, why should stakeholders
care about preventing previous attacks?

internal morale!
Its downhill slide started with the leaked training

have dissolved completely.

■ Karakurt■ HelloKitty

playbooks for affiliate Conti ransomware members.
The final nail in the coffin came when an anonymous
Ukrainian IT specialist broke into the gang’s network toleak years of internal material.

■ AvosLocker■ Hive■ ALPHV – and others!

But, just because Conti is “dead,” doesn’t mean its
suddenly defunct.

single criminal organization seems to■ BlackByte■ BlackBastapublished the organization’s affiliate

documents on Twitter, “Conti” as agangs, including:ironically, due to its own poor operational security andhackers aren’t still operating or that its code issecurity researchers leaked its internal

seen Conti-style tactics from other cybercriminalFrankly, Conti had a reputation problem for a while –However, since internal malcontents
training playbook and external

Recently, cybersecurity researchers and analysts have

After all, Conti had an extensive affiliate organization,
who were clearly trained on how to use the written
ransomware code and techniques that still present
themselves as a threat to any organization with thevulnerabilities still present.

By studying previous Conti incidents, today’s

And, it’s not like the hackers, programmers and social

proactive organizations can prevent a multitude

engineers at the Conti organization itself were arrestedof similar attacks run by smaller threat actors

or died.

using Conti’s tactics.

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

34

Conti Stat Sheet
Aliases:
No longer available

Motive:Criminal / Financial

Threat Type:
Ransomware-as-a-Service (RaaS)

Affiliations and Associations:
RussiaBlackBasta

Hive

BlackByte

HelloKitty

AvosLocker

Karakurt

ALPHV

Wizard Spider

Critical At-risk Industries:
Government

Hospitality

Education

FinanceFinance

Food & Beverage

EnergyTechnology

Retail & eCommerce

Manufacturing

Healthcare

Favorite Exploits:

Known Targeted Regions:

CVE-2017-0143

CVE-2018-13379

CVE-2021-44228

CVE-2019-1069

CVE-2019-1388

CVE-2021-21972

Australia

New ZealandCVE-2017-0144

CVE-2020-0796

CVE-2015-2546

CVE-2019-1129

CVE-2019-1405

CVE-2021-21985

CanadaScandinavia

CVE-2017-0145

CVE-2020-1472

CVE-2016-3309

CVE-2019-1130

CVE-2019-1458

CVE-2021-22005

Costa Rica

Spain

CVE-2017-0146

CVE-2021-1675

CVE-2017-0101

CVE-2019-1215

CVE-2020-0609

CVE-2021-26855

Germany

TaiwanCVE-2017-0147

CVE-2021-31207

CVE-2018-8120

CVE-2019-1253

CVE-2020-0638

Indonesia

United Kingdom

CVE-2017-0148

CVE-2021-34473

CVE-2019-0543

CVE-2019-1315

CVE-2020-0688

IrelandUnited State

CVE-2018-12808

CVE-2021-34523

CVE-2019-0841

CVE-2019-1322

CVE-2020-0787

Japan

CVE-2018-13374

CVE-2021-34527

CVE-2019-1064

CVE-2019-1385

CVE-2021-1732

Latin America

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

35

Organization Impact of SelectConti Attacks“

Of the 65,000
computers in Delta[Electronic]’s network,
about 1,500 servers
and about 12,000
computers are
encrypted. […] It has
been nearly a weeksince the incident, andthe Delta website has
not yet been restored,
and the impact of
the loss may exceed
expectations.

“January 21, 2022: Delta Electronics
Manufacturing | Taiwan“[…] Conti had encrypted over 4,000 devices
and 120 VMware ESXi servers belonging to
Shutterfly. A private data leak page also
showed samples of the data stolen from
Shutterfly, which we are told included legal
agreements, bank and merchant accountinfo, […] and what appears to be customer
information, including the last four digits ofcredit cards.”“

Attacked December 3, 2021 – Reported December 26, 2021:
Shutterfly | Retail & eCommerce | United States““At this stage we cannot safely processorders or dispatch goods. We have teams
working through the resolution, but it isunknown when this will be resolved.”“BI is aware of a ransomware hack last month.
We are aware that we have been hit by a cyberattack. This is a crime, it is real, and we areexposed to it.”
Attacked December 2021 – Reported January 20, 2022:
Bank of Indonesia | Finance | Indonesia“

January 28, 2022: KP Snacks | Food & Beverage
United Kingdom““Christian Rucavado, executive directorof Costa Rica’s Exporters Chamber, said
the attack on the customs agency had
collapsed the country’s import and export
logistics. He described a race against theclock for perishable items waiting in cold
storage and said they still didn’t have an
estimate for the economic losses.”“To safeguard customer assets, remote
access from Nordex Group IT infrastructure
was disabled for turbines under contract.
[… The] company is continuing to restore
its IT systems such as to enable business
continuity and resume normal operations assoon as reasonably practicable.”
March 31, 2022: Nordex | Manufacturing / Energy | Germany“
DISBANDED by JUNE 2022

April 18, 2022: Finance, Labor and Social Security Ministries
Government | Costa Rica

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

36

A Conti Legacy Cyberdefense Strategy:
How to Break Conti-styled Attacks Before the Ransom Request

Enter network throughphishing campaigns,
weak firewalls and /or badly configured
internet-connectedservers or devices.

Gain admin privilegeson hacker user
accounts, proactively
disguising activity as
legitimate.

Map network forstrategic information
and weaknesses.

Exfiltrate data to holdfor extortion.

When intruders can’t

lock data, then they have little

move freely or easily inleverage to demand a ransom.

Limiting intruders’ ability to

the network, they can’t

Stopping hackers before they

elevate credentials helps

enter the network is the easiest,

prevent data theft andcheapest and fastest way toextortion.

If the hackers can’t steal or

Launch ransomware
and make extortion
demands, withpossible DDoS attack
to pressure forpayment.

find important data or
vulnerabilities – mitigating
major business impact.

protect every business unit
without disrupting operations.

EDR

User Access Control

Restrict Web-based
Content

Privilege Management

Antivirus / Malware
Anti-Phishing on Mobile
User Training & Education

Configuration Management

Risk-based Patch &Vulnerability Management
Device & Segmentation

Security Program Audits

Device Hygiene &Management

User Training & Education

Asset Reconciliation
Secure Access Protocols

Passwordless MFA

Security Program Audits

Application Control

EDR

Strategic Automation

Restricting Web-based
ContentToolate
for proactive
User
AccessControl
prevention; shift toStrategic Automation!

$“disaster recovery” mode.

Malicious Encryption
Detection & Isolation

Network Segmentation

User Access Control

Privilege Management

Application Control

Strategic Automation

Device Hygiene &Management

Configuration Management

Security Program Audits
Strategic Automation
Configuration Management

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index37

Lapsus$Like Conti, this seemingly spontaneous resurrection

and other hackable information on major companiesof Lapsus$ as a cybercriminal threat can help you

and organizations. They’d be willing to trade

remind your non-InfoSec stakeholders that evencryptocurrencies for the information, if the informant“dead” cyberthreats should still be defended against.

wanted to be paid.

However, we included Lapsus$ as the groupAnd, disgruntled employees did seem to takerepresents a wildly different type of motivation foradvantage of their offer.

attack and infiltration method.

In the weeks and months that followed the initialSee, Lapsus$ doesn’t seem to be primarily motivatedTelegram post, several major organizations publicly

by money, though they certainly ransom information

announced breaches they attributed to theand blackmail organizations into forking over millions.

Lapsus$ gang.

16-year-old hacker with autism going

Instead, Lapsus$ hackers appear to attack out ofOnce they gained access to an organization, theyby “White” or “Breachbase” – incuriosity – “Can I even do this?” – and that age-old

would move laterally through the system as far

March 2022.

young person’s drive for attention by any

as they could – going so far as to internally phishmeans necessary.

other employees and IT departments using theLike Conti, everyone thought Lapsus$
was finished with the City of London
Police’s arrest of their ringleader – a

But, just a few months later, big
corporations pinned their old breaches
on the thought-defunct gang. And
then, altogether new infiltrations atmajor technology companies grabbed
the headlines!

compromised credentials. They could access shared

Why should a bunch of teen hackers
worry your stakeholders?

drives, lurk in the background of meetings andTo convince your stakeholders on why Lapsus$

Then, Lapsus$ hackers could export data, delete it

discover unencrypted password docs.

attacks are worth investing in to avoid attack, you’ll
first need to illustrate just how different an infiltration
and attack method these teenagers leveraged.

and watch the mayhem unfold from the inside. They
could even deliver ransom demands through internal
communication channels!

After all, these hackers didn’t have a ton of money
or connections, like our other featured threat actors.
They didn’t have time to dedicate to a criminal

If your employee morale is critically low and yourenterprise, like adult hackers whose full-time job was

non-InfoSec stakeholders don’t take ownership ofmaking money from criminal activity.

their own roles in cybersecurity, then they represent

Instead, Lapsus$ hackers leveraged the tools at theirdisposal to infiltrate organizations: social media.

grave “insider threats” to your organization’s
operational security – both inside and out –exemplified by Lapsus$ cyberattack patterns.

On their public Telegram channel, Lapsus$
announced that they were looking for initial logins

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

38

Lapsus$ Stat Sheet
Aliases:
N/A

Motive:Hacktivists, Financial

Threat Type:
General Hackers

Affiliations and Associations:
UNC2447
Yanluowangr

Critical At-risk Industries:
Entertainment
Technology

Favorite Exploits:

Known Targeted Regions:

CVE-2021-34484

CVE-2021-44957

CVE-2021-45325

CVE-2021-34484

Brazil

CVE-2018-13379

CVE-2021-45326

CVE-2021-44956

CVE-2022-21919

FranceSouth Korea
United States

CVE-2020-12812

CVE-2021-45328

CVE-2021-34473

CVE-2022-26904

CVE-2020-23852

CVE-2022-0510

CVE-2021-26858

CVE-2021-34484

CVE-2021-26857

CVE-2022-21702

CVE-2021-26855

CVE-2021-31207

CVE-2022-0139

CVE-2020-23705

CVE-2021-44864

CVE-2021-45327

CVE-2019-5591

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

39Organization Impact of SelectLapsus$ Attacks“

The attacker thenrepeatedly tried to log into the contractor’s Uberaccount. Each time,
the contractor received
a two-factor login
approval request, which
initially blocked access.
Eventually, however, thecontractor accepted
one, and the attacker
successfully logged in.

“

September 15, 2022: Uber | Technology
United States“I am greatly disappointed by the long
period of time that transpired between our
notification to [firm] and the issuance ofthe complete investigation report. Uponreflection, once we received the [firm’s]
summary report we should have moved more
swiftly to understand its implications.”“

January 2022: Okta | Technology | United States““According to our initial analysis, thebreach involves some source codes
relating to the operation of Galaxy
devices but does not include the personal
information of our consumers or
employees.”“

Announced March 3, 2022: Samsung | Electronics /Manufacturing | South Korea“On September 11, 2022, the bad actors
who previously published a list of file names
from this security incident to the dark web,posted the actual contents of the same files
to the same location on the dark web.”
Attacked May 24, 2022 – Reported August 10, 2022: Cisco
Electronics / Manufacturing | United States““““We are aware that the threat actor [Lapsus$]
took employee credentials and some Nvidia
proprietary information from our systems andhas begun leaking it online.”
February 23, 2022: Nvidia | Electronics / Manufacturing
United States“When posting the torrent, Lapsus$ said it
contained 90% of the source code for Bingand approximately 45% of the code for Bing
Maps and Cortana.”
March 20, 2022: Microsoft | Technology | United States“We recently suffered a network intrusion inwhich an unauthorized third party illegally
accessed and downloaded confidential
information from our systems, including early
development footage for the next Grand
Theft Auto.”
September 19, 2022: Rockstar Games | Entertainment
United States

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

40

Your Lapsus$ Cyberdefense Strategy:
How to Break Lapsus$ Attacks Before Vandalism or Deletion

Enter network throughinsider threat’s
credentials, as well as
employees’ personalaccounts as “backdoor”
to employer network.

Search for exposed
credentials in open
shared databases orby social engineeringinternal attacks
from within.

Exfiltrate data foreither notoriety(proof of hack) or for
future extortion.

Stopping hackers before they

Limiting intruders’ ability toleverage to demandenter the network is the easiest,change or elevate credentials

cheapest and fastest way tohelps prevent data theftprotect every business unit

and extortion.

If the hackers can’t steal
data, then they have little

Begin extortion –possibly from thevictim’s own internal
channels! – asorganization begins
incident response.

a ransom.

without disrupting operations.

User Access Control

User Access Control

Privilege Management

Privilege Management

Security Program Audits

Security Program Audits

Application Control

Application Control

Passwordless MFA

Passwordless MFA

Network Segmentation

Network Segmentation

User Training & Education

User Training & Education

Strategic Automation

Strategic Automation

Restricting Web-Based
Content$!

User Access Control

Too late for proactive

Privilege Management

prevention; shift to“disaster recovery” mode.

Network Segmentation
Application Control
EDR
Security Program Audits
Strategic Automation
Device Hygiene &Management

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

41

InfoSec Tactical Index

In This Section
MITRE Analysis for Threat Actors

InfoSec Tactical Index

ALPHV MITRE ATT&CK Map		

44

APT29 MITRE ATT&CK Map		

45

Conti MITRE ATT&CK Map		

46

Lapsus$ MITRE ATT&CK Map		

47

References and Sources		

48

2023 Cyberstrategy Tool Kit for Internal Buy-In

43

ALPHV MITRE ATT&CK Map
1. Reconnaissance

5. Persistence

7. Defense Evasion

9. Discovery

11. Collection

T1595: Active Scanning

T1098: Account Manipulation

T1564: Hide Artifacts

T1005: Data from Local System

6. Privilege Escalation

8. Credential Access

T1548: Abuse Elevation Control Mechanism

T1003: OS Credential Dumping
T1003.001: LSASS Memory
T1003.004: LSA Secrets

T1082: System Information Discovery
T1135: Network Share Discovery
T1018: Remote System Discovery
T1087: Account Discovery
T1087.002: Domain Account
T1487: Domain Trust Discovery
T1057: Process Discovery
T1083: File & Directory Discovery

T1589: Gather Victim Identity Information
T1589.001: Credentials

2. Resource Developmentn/aT1548.002: Bypass User Account Control

3. Initial Access10. Lateral Movement

T1078: Valid Accounts

T1563: Remote Service Hijacking
T1563.002: RDP Hijacking
T1570: Lateral Tool Transfer

T1190: Exploit Public-Facing Application

4. Execution

12. Command and Control
T1090: Proxy
T1090.003: Multi-hop Proxy

13. Exfiltration
T1567: Exfiltration Over Web Service
T1567.002: Exfiltration to Cloud Storage

14. Impact
T1486: Data Encrypted for Impact
T1489: Service Stop
T1490: Inhibit System Recovery

n/a2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

44

APT29 MITRE ATT&CK Map
1. Reconnaissance

5. Persistence

7. Defense Evasion

8. Credential Access

11. Collection

n/aT1053: Scheduled Task/Job
T1053.005: Scheduled Task

T1027: Obfuscated Files or Information

T1078: Valid Accounts

T1036: Masquerading

T1003: OS Credential Dumping
T1003.006: DCSync
T1005: Data from Local System
T1552: Unsecured Credentials
T1552.004: Private Keys
T1555: Credentials from Password Stores
T1558: Steal or Forge Kerberos Tickets
T1558.003: Kerberoasting
T1606: Forge Web Credentials:
T1606.001: Web Cookies
T1606.002: SAML Tokens

T1074: Data Staged
T1074.002: Remote Data Staging
T1114: Email Collection
T1114.002: Remote Email Collection
T1560: Archive Collected Data
T1560.001: Archive via Utility

2. Resource Development
T1583: Acquire Infrastructure
T1583.001: Domains
T1583.006: Web Services
T1584: Compromise Infrastructure
T1584.001: Domains
T1587: Develop Capabilities
T1587.001: Malware
T1587.003: Digital Certificates

T1078.002: Domain Accounts
T1098: Account Manipulation
T1098.001: Additional Cloud 		
Credentials
T1098.002: Additional Email Delegate
Permissions
T1133: External Remote Services
T1546: Event Triggered Execution
T1546.003: Windows Management
Instrumentation Event Subscription

3. Initial Access
T1078: Valid Accounts
T1078.002: Domain Accounts
T1133: External Remote Services
T1190: Exploit Public-Facing Application
T1195: Supply Chain Compromise
T1195.002: Compromise Software 		Supply Chain
T1566: Phishing
T1566.001: Spearphishing Attachment
T1566.002: Spearphishing Link

T1546.008: Accessibility Features

6. Privilege Escalation

Service
T1036.005: Match Legitimate Nameor Location
T1070: Indicator Removal on Host
T1070.004: File Deletion
T1070.006: Timestomp
T1078: Valid Accounts
T1078.002: Domain Accounts
T1140: Deobfuscate/Decode Files or 		
Information
T1218.011: Rundll32
T1484: Domain Policy Modification
T1484.002: Domain Trust 		

T1053: Scheduled Task/Job
T1053.005: Scheduled Task

Modification
T1548: Abuse Elevation Control Mechanism

T1078: Valid Accounts
T1078.002: Domain Accounts
T1484: Domain Policy Modification
T1484.002: Domain Trust Modification
T1546: Event Triggered Execution
T1546.003: Windows Management
T1546.008: Accessibility Features
T1547: Boot or Logon Autostart Execution

T1047: Windows Management Instrumentation

T1036.004: Masquerade Task or 		T1218: System Binary Proxy Execution

Instrumentation Event Subscription

4. Execution

T1027.002: Software Packing

T1547.009: Shortcut Modification

T1548.002: Bypass User Account 		
Control
T1550: Use Alternate Authentication Material
T1550.003: Pass the Ticket

T1553.002: Code Signing
T1562: Impair Defenses
T1562.001: Disable or Modify Tools
Logging

T1204.001: Malicious Link

T1562.004: Disable or Modify System Firewall

T1204.002: Malicious File

T1016: System Network Configuration
Discovery
T1016.001: Internet Connection 		
Discovery
T1018: Remote System Discovery
T1057: Process Discovery
T1069: Permission Groups Discovery
T1082: System Information Discovery
T1083: File and Directory Discovery
T1087: Account Discovery
T1482: Domain Trust Discovery

T1053: Scheduled Task/Job

T1001: Data Obfuscation
T1001.002: Data Obfuscation: 		Steganography
T1071: Application Layer Protocol
T1071.001: Web Protocols
T1090: Proxy
T1090.001: Internal Proxy
T1090.003: Multi-hop Proxy
T1090.004: Domain Fronting
T1095: Non-Application Layer Protocol
T1102: Web Service
T1102.002: Bidirectional Communication
T1105: Ingress Tool Transfer
T1568: Dynamic Resolution

13. Exfiltration

T1550.004: Web Session Cookie
T1553: Subvert Trust Controls

T1562.002: Disable Windows Event

T1204: User Execution

9. Discovery

12. Command and Control

10. Lateral Movement
T1021: Remote Services
T1021.006: Windows Remote 		Management
T1550: Use Alternate Authentication Material
T1550.003: Pass the Ticket
T1550.004: Web Session Cookie

T1048: Exfiltration Over Alternative Protocol
T1048.002: Exfiltration Over 		Asymmetric Encrypted
Non-C2 Protocol

14. Impact
n/aT1053.005: Scheduled Task
T1059: Command and Scripting Interpreter
T1059.001: PowerShell
T1059.003: Windows Command Shell
T1059.006: Python
T1203: Exploitation for Client Execution

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

45

Conti MITRE ATT&CK Map
1. Reconnaissance
T1595: Active Scanning

2. Resource Developmentn/a

6.Privilege Escalation

7. Defense Evasion

8. Credential Access

10. Command and Control

T1037: Boot or Logon Initialization Scripts

T1027: Obfuscated Files or Information

T1005: Software Deployment Tools
T1080: Taint Shared Content

n/aT1027.003: Steganography

T1055: Process Injection
T1134: Access Token Manipulation

T1014: Rootkit

T1543: Create or Modify System Process

T1036: Masquerading
T1036.005: Match Legitimate Name orT1543.001: Launch Agent

Location

3.Initial Access

T1543.002: Systemd Service
T1543.003: Windows Service

T1055: Process Injection

T1190: Exploit Public-Facing Application

T1543.004 Launch Daemon

T1112: Modify Registry

T1566: Phishing

T1546: Event Triggered Execution

T1566.001: Spearphishing Attachment

T1546.001: Change Default File 		

T1566.002: Spearphishing Link

Association

T1566.003: Spearphishing via Service

T1546.004: Unix Shell Configuration

T1218: Signed Binary Proxy Execution

12. Impact
T1498: Network Denial of Service
T1498.001: Direct Network Flood

T1542.003: Bootkit

T1546.008: Accessibility Features

T1542.004: Install Root Certificate

T1547: Boot or Logon Autostart Execution

T1548: Abuse Elevation Control Mechanism

T1547.006: Kernel Modules and 		

T1553: Subvert Trust Controls

T1203: Exploitation for Client Execution

Extensions

T1562: Impair Defenses

T1547.009: Shortcut Modification

T1037: Boot or Logon Initialization Scripts
T1542: Pre-OS Boot
T1542.003: Bootkit
T1543: Create or Modify System Process
T1543.001: Launch Agent
T1543.002: Systemd Service
T1543.003: Windows Service
T1543.004: Launch Daemon
T1546: Event Triggered Execution
T1546.001: Change Default File Association
T1546.004: Unix Shell Configuration
Modification
T1546.008: Accessibility Features
T1547: Boot or Logon Autostart Execution
T1547.006: Kernel Modules and Extensions
T1547.009: Shortcut Modification
T1574: Hijack Execution Flow
T1574.008: Path Interception by Search
Order Hijacking
T1574.009: Shortcut Modification
T1574.010: Services File Permissions

T1020: Automated Exfiltration
T1020.001: Traffic Duplication

T1542: Pre-OS Boot

T1072: Software Deployment Tools

5. Persistence

T1005: Data from Local System
T1039: Data from Network Shared Drive
T1115: Clipboard Data
T1123: Audio Capture
T1125: Video Capture

T1218.001: Compiled HTML File

Modification

4. Execution

T1134: Access Token Manipulation

11. Exfiltration
9. Collection

T1548: Abuse Elevation Control Mechanism
T1574: Hijack Execution Flow

T1562.001: Disable or Modify Tools
T1574: Hijack Execution Flow
T1574.010: Services File Permissions

T1574.010: Services File Permissions

Weakness

Weakness

T1574.011: Services Registry Permissions

T1574.011: Services Registry Permissions

Weakness

Weakness

Weaknesses
T1574.011: Services Registry Permissions
Weakness2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

46

Lapsus$ MITRE ATT&CK Map
1. Reconnaissancen/a

2. Resource Development

5. Privilege Escalation

7. Defense Evasion

8. Credential Access

11. Collection

T1068: Exploitation for Privilege Escalation

T1027: Obfuscated Files or Information

T1003: OS Credential Dumping
T1003.001: LSASS Memory
T1111: Two-Factor Authentication Interception
T1212: Exploitation for Credential Access
T1528: Steal Application Access Token
T1552: Unsecured Credentials
T1552.001: Credentials in Files
T1552.004: Private Keys
T1555: Credentials from Password Stores
T1555.005: Password Managers

T1039: Data from Network Shared Drive
T1114: Email Collection
T114.003: Email Forwarding RuleT1213: Data from Information Repositories
T1213.002: Sharepoint
T1213.003: Code Repositories

T1027.002: Software Packing

T1078: Valid Accounts
T1078.002: Domain Accounts

T1078: Valid Accounts
T1078.002: Domain Accounts

n/a

3. Initial Access
T1078: Valid Accounts
T1133: External Remote Services
T1190: Exploit Public-Facing Application
T1199: Trusted Relationship

4. Execution

T1078.003: Local Accounts

6. Persistence

T1078.004: Cloud Accounts

T1021: Services
T1021.001: Remote Desktop Protocol
T1078: Valid Accounts
T1078.002: Domain Accounts
T1078.003: Local Accounts
T1078.004: Cloud Accounts
T1114: Email Collection
T1114.003: Email Forwarding RuleT1133: External Remote Services

T1553: Subvert Trust Controls
T1553.002: Code Signing
T1562: Impair Defenses
T1562.001: Disable or Modify Tools

9. Discovery
T1016: System Network Configuration
Discovery
T1016.001: Internet Connection Discovery
T1069: Groups Discovery
T1069.002: Domain Groups
T1082: System Information Discovery
T1482: Domain Trust Discovery

T1059: Command and Scripting Interpreter
T1059.001: PowerShell
T1059.003: Windows Command Shell
T1059.004: Unix Shell

12. Exfiltration
T114: Email Collection
T1114.003: Email Forwarding RuleT1537: Transfer Data to Cloud AccountT1567: Exfiltration Over Web Service

13. Impact
T1485: Data Destruction
T1529: System Shutdown/Reboot

T1072: Software Deployment Tools

10. Lateral Movement
T1021: Services
T1021.001: Remote Desktop Protocol
T1534: Internal Spearphishing
T1078: Valid Accounts
T1078.002: Domain Accounts

2023 Cyberstrategy Tool Kit for Internal Buy-In

Defense Directory

Threat Actors

Tactical Index

47

References and Sources
In addition to all of the analysts, reporters and organizations listed here, weoffer special thanks to the researchers and internal experts at Cyber Security
Works and Ivanti, who provided access to industry insights and proprietary
information that helped make this Tool Kit possible.

2023 Cyberstrategy Tool Kit for Internal Buy-In

48

NIST, “Advanced Persistent Threat.”“Ubisoft Cyber Security Incident Update.” Ubisoft.

“2022 Global Threat Report.” Crowdstrike.

“Update on cyber security incident.” The Nordex Group.

“Alert (AA22-047A): Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to
Obtain Sensitive U.S. Defense Information and Technology.” Cybersecurity & Infrastructure Security Agency(CISA).

Abrams, Lawrence. “Lapsus$ hackers leak 37GB of Microsoft’s alleged source code.” Bleeping Computer.

“APT29.” MITRE ATT&CK.

Amitai Cohen via @AmitaiCo.

“Cisco Data Breach Attributed to Lapsus$ Ransomware Group.” Dark Reading.

Australian Cyber Security Centre (ACSC). “2021-010: ACSC Ransomware Profile - Conti.”“Cisco Event Response: Corporate Network Security Incident.” Cisco Security.

Batra, Anirudh. “Detailed Analysis of LAPSUS$ Cybercriminal Group that has Compromised Nvidia, Microsoft,
Okta, and Globant.” CloudSEK.

“CISCO Talos shares insights related to recent cyber attack on Cisco.” Cisco Talos.
“DEV-0537 criminal actor targeting organizations for data exfiltration and destruction.” Microsoft Security.
“Encevo Cyberattack.” Encevo.
“Experts Call the Conti Ransomware Gang Who Broke BI Dangerous Hackers.” CNN Indonesia.
“General Security Advisory: Understanding and preparing for cyber threats relating to tensions between
Russia and Ukraine.” National Cyber Security Centre (NCSC).
“Globant official update.” Globant.
“Hacker attack on the province of Carinthia: “Black Cat” wants five million dollars in Bitcoin.” DerStandard.
“Incident and Agency Updates.” Fremont County Colorado.
“Lapsus$: An In-Depth Look at Data Extortion Group.” Avertium.

Abrams, Lawrence. “Shutterfly discloses data breach after Conti ransomware attack.” Bleeping Computer.

Bill Demirkapi via @BillDemirkapi.
Bradbury, David. “Updated Okta Statement on LAPSUS$.” Okta.
Brett Callow via @BrettCallow.
Brown, David; Matthews, Michael; Smallridge, Rob. “LAPSUS$: Recent techniques, tactics and procedures.”nncgroup.
Burgess, Matt. “The Workaday Life of the World’s Most Dangerous Ransomware Gang.” Wired.
Cimpanu, Catalin. “Disgruntled ransomware affiliate leaks the Conti gang’s technical manuals.” The Record.
Clark, Mitchell. “Nvidia says its ‘proprietary information’ is being leaked by hackers.” The Verge.
conti leads via @ContiLeaks.

“MITRE Mapping of CISA KEVs and its Challenges.” Cyber Security Works.

CÓRDOBA, Javier; Sherman, Christopher. “Cyber attack causes chaos in Costa Rica government systems.” APNews.

“Moncler Press Release - Update on Malware Attack.” Moncler Group.

Culafi, Alexander. “AdvIntel: Conti rebranding as several new ransomware groups.” SearchSecurity.

“Nordex Group impacted by cyber security incident.” The Nordex Group.

Cyberpedia. “What is the MITRE ATT&CK Framework?” Cortex.

“RE: NOTICE OF DATA BREACH.” Meyer Corporation.

DarkFeed via @ido_cohen2.

“RESPONSE TO LATEST MEDIA REPORTS ABOUT 27 NOVEMBER CYBER SECURITY INCIDENT.” CS Energy.

DarkTracer : DarkWeb Criminal Intelligence via @darktracer_int.

“Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor
Authentication Protocols and “PrintNightmare” Vulnerability.” Cyber & Infrastructure Security Agency (CISA).

Davis, Griffin. “’GTA 6’ Leaker Arrested! Authorities Claim Teenager is Linked to Lapsus$ Hacking Group.”
Tech Times.

“Russia-Nexus UAC-0113 Emulating Telecommunication Providers in Ukraine.” Insikt Group: Recorded Future.

Digital Security Unit. “Special Report: Ukraine - An overview of Russia’s cyberattack activity in Ukraine.”
Microsoft.

“Security update.” Uber Newsroom.
“STATEMENT ABOUT CYBERSECURITY INCIDENT: DECEMBER 26, 2021.” Shutterfly, Inc.
“Statement from Oiltanking GmbH Group and Mabanaft GmbH & Co. KG Group.” Mabanaft Communications.
“Threat Report: T3 2021.” ESET Security Research.

DISSENT. “AlphaV claims attack on Florida International University (updated).” DataBreaches.net.
Fadilpašić , Sead. “Conti ransomware group officially shuts down - but probably not for long.” techradar.pro.
Fardkhmanesh, Megan. “The Real Impact of the Grand Theft Auto and Diablo Leaks.” Wired.

2023 Cyberstrategy Tool Kit for Internal Buy-In

49

Fox, Barbara. “Fremont County government services closed due to a cyber security breach.” KRDO News.

Pearson, James. “UPDATE 4-Shell re-routes oil supplies after cyberattack on German firm.” Reuters.

Ganti, Anil. “Samsung says your personal info wasn’t leaked in its recent data hack.” SamMobile.

Peters, Jay. “Ubisoft says it experienced a ‘cyber security incident’, and the purported Nvidia hackers aretaking credit.” The Verge.

Greenberg, Andy (2019) Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin’s Most Dangerous
Hackers.
Greenberg, Andy. “Destructive Hacks Against Ukraine Echo Its Last Cyberwar.” Wired.
Greig, Jonathan. “BlackCat ransomware group claims attack on Florida International University.” The Record.
Greig, Jonathan. “Louisiana authorities investigating ransomware attack on city of Alexandria.” The Record.
Greig, Jonathan. “North Carolina A&T hit with ransomware after ALPHV attack.” The Record.
Gupta, Surojoy. “All About Conti.” Cyber Security Works.
Gurevich, M (1961) The Social Structure of Acquaintanceship Networks, Cambridge, MA: MIT Press
Harbison, Mike; Renals, Peter. “Russian APT29 Hackers Use Online Storage Services, DropBox and Google
Drive.” Unit 42, Palo Alto Networks.

Pink, Bidara. “Last month Bank Indonesia (BI) was hit by a cyber attack, but it has been resolved.” Kontan
Indonesia.
Polityuk, Pavel. “EXCLUSIVE Ukraine suspects group linked to Belarus intelligence over cyberattack.” Reuters.
Ransomware Index Update: Q2-Q3 2022. Cyber Security Works, Ivanti.
Ravindran, Priya. “All about BlackCat (ALPHV).” Cyber Security Works.
Rewards for Justice via @RFJ_USA.
Rockstar Games via @RockstarGames.
Scullion, Chris. “Bandai Namco confirms it’s been hacked and says it’s investigating damage.” VGC News.
Sharma, Ax. “KP Snacks giant hit by Conti ransomware, deliveries disrupted.”

Hill, Michael. “Cisco admits hack on IT network, links attacker to LAPSUS$ threat group.” CSO.

Soloman, Howard. “Canadian military provider suffered ransom attack, says news report.”

Jenkins, Luke; Hawley, Sarah; Najafi, Parnian; Bienstock, Doug. “Suspected Russian Activity Targeting
Government and Business Entities Around the Globe.” Mandiant.

Taipei, Peng Yuwen. “Delta’s servers were hacked, and some system recovery operations are estimated tohave no major impact.” Yahoo News: Taiwan.

Kabelka, Laura. “Austria’s Carinthia halts passport issuance over ransomware attack.” Euractiv.

Temple-Raston, Dina. “A ‘Worst Nightmare’ Cyberattack: The Untold Story of the SolarWinds Hack.” NPR.

Kan, Michael. “Nvidia Confirms Company Data Was Stolen in Hack.” PC Mag.

The Reliants Project, “Six Degrees of Kevin Bacon.”

Koczwara, Michael. “LAPSUS$ TTPs.”

Tidy, Joe. “Lapsus$: Oxford teen accused of being multi-millionaire cyber-criminal.” BBC News.

Lakshmanan, Ravie. “Uber Blames LAPSUS$ Hacking Group for Recent Security Breach.” The Hacker News.

Todd MicKinnon via @toddmckinnon.

Lakshmanan, Ravie. “Uber Claims No Sensitive Data Exposed in Latest Breach… But There’s More to This.”
The Hacker News.

Uchill, Joe. “Globant confirms falling victim to Lapsus$ extortion group.” SC Magazine.

Lyngaas, Sean. “‘I can fight with a keyboard’: How one Ukrainian IT specialist exposed a notorious Russian
ransomware gang.” CNN.
Mari, Angelica. “Brazilian Ministry of Health suffers cyberattack and COVID-19 vaccination data vanishes.”
ZDNet.

Wadhwani, Sumeet. “Former Conti Members Are Now BlackBasta, BlackByte and Karakurt Members.”
spiceworks.
Wadhwani, Sumeet. “Ransomware Group Lapsus$ Cries Foul After NVIDIA Allegedly Does a Tit-for-Tat.”
spiceworks.

Meta / Facebook, “Three and a half degrees of separation.”

Werkmeister, Luke. “Ripple effects of ransomware attack against Suffolk County continue more than a week
later.” The Suffolk Times.

Minggeng, Liu. “Exclusive / Delta was hacked and extorted 410 million yuan, estimated about 13,500
computers were encrypted.” CTWant News.

Wolfram, John; Hawley, Sarah; McLellan, Tyler; Simonian, Nick; Veilby, Anders. “Trello From the Other Side:
Tracking APT29 Phishing Campaigns.” Mandiant.

Newman, Lily Hay. “The Dire Warnings in the Lapsus$ Hacker Joyride.” Wired.

Zetter, Kim (2015) Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon.

Panettieri, Joe. “Lapsus$ Cyberattack vs Okta, Sitel: Up to 366 Okta Customers Impacted.” MSSP Alert.

2023 Cyberstrategy Tool Kit for Internal Buy-In

50

2023
Cyberstrategy Tool Kit
for Internal Buy-In
How to Win Budget and Influence Stakeholders
by Explaining Why Your Cybersecurity Strategy
Matters to Non-InfoSec Outsiders

ivanti.com
1 800 982 2130
sales@ivanti.com

in collaboration with

Copyright © 2022, Ivanti. All rights reserved. IVI-2720 ARS/KF